Skip to content

Seccomp_filters showed 1 in /proc/$ESCALATED_PROC/status #2706

@RocketMaDev

Description

@RocketMaDev

Please check before submitting an issue

  • I have searched the issues and haven't found anything relevant
  • I will upload bugreport file in KernelSU Manager - Settings - Report log
  • I know how to reproduce the issue which may not be specific to my device

Describe the bug

KernelSU will turn off seccomp filters when escalating privilege,

static void disable_seccomp()
{
	assert_spin_locked(&current->sighand->siglock);
	// disable seccomp
#if defined(CONFIG_GENERIC_ENTRY) &&                                           \
	LINUX_VERSION_CODE >= KERNEL_VERSION(5, 11, 0)
	current_thread_info()->syscall_work &= ~SYSCALL_WORK_SECCOMP;
#else
	current_thread_info()->flags &= ~(TIF_SECCOMP | _TIF_SECCOMP);
#endif

#ifdef CONFIG_SECCOMP
	current->seccomp.mode = 0;
	current->seccomp.filter = NULL;
#else
#endif
}

However, it seems that it doesn't release seccomp filters correctly, and might lead to memory leak.

To Reproduce

  1. run cat /proc/self/status and refer to seccomp section (NoNewPrivs:0, Seccomp:2, Seccomp_filters:1)
  2. run sudo cat /proc/self/status and refer to seccomp section (NoNewPrivs:0, Seccomp:0, Seccomp_filters:1)

Expected behavior

Clear seccomp filter bpf reference when disabling it, that is, display NoNewPrivs: 0, Seccomp: 0, Seccomp_filters: 0 in /proc/$PROC/status

Screenshots

No response

Logs

No response

Device info

  • Device: Mi 13
  • OS Version: MIUI 14.0.31
  • KernelSU Version: v1.0.5
  • Kernel Version: 5.15.167

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions